Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a debian linux firewall/gateway connecting my wan and lan working with iptables. I have eth1 as the wan with dynamic address attached to via DYNDNS and eht0 as the lan with address Everything works as expected. Traffic coming in gets rejected for all ports except the ones specified with ACCEPT and the port forwarding works as expected redirecting traffic to the inside machines.

The problem is that when I try to connect to from the inside network I don't get redirected to the internal machines as I expect. My firewall rules for port redirection are attached to the wan interface (eth1). I'm assuming that when I try to connect to I'm coming from the lan connection and that is why the redirection does not work. I have experimented with REDIRECT, DNAT, INPUT and other tags without success. Any hints on how to achieve this?

share|improve this question
It would help if you included your actual iptables rules – freiheit Jun 21 '09 at 17:20

I don't know the answer to your question. However as a work around why not had a fake DNS entry internally for pointed at the LAN IP instead?

share|improve this answer

you have to masquarade the forwarded packets to appear as if they are comming from the firewall

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

otherwise the return packets will be coming to you from the internal hosts itself who are seeing internal adresses and sending the packets directly back. So you are sending requests to but getting the replies from 192.168.128.x, its quite normal that your machine doesn't know what to do with them :)

share|improve this answer

You should try adding a local DSN entry as stated by Mr. Joel Mansford, in Debian edit the file:


add entries in this format:


share|improve this answer

I can guess that the problem is that you are doing ip masquerading (SNAT) and DNAT on the packets.

Let's say you connect from internal host

The original packet would be: -> (

Then because of DNAT it would get translated to: -> (

I guess this is where the problem is: from and to addresses are the same.

You should run tcpdump or tshark in the connecting machine, every interface of the firewall and the receiving machine. Then try to connect and try to see in which interface the packets are lost and the from and to addresses as they get translated.

Once you understand it, you can create a filter to address that specific problem in the correct interface.

Otherwise you can use the DNS solution stated by joelmansford which may be a cleaner solution.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.